MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The critical PDF_SEO_LINK_FARM heuristic indicates this PDF contains a large number of links to external PDF files hosted on various domains. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The primary attack pattern involves redirecting users to a link farm, likely for SEO manipulation or to serve additional malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://printable-ebooks.com/uploads/1/3/0/5/130550787/juzifuvimani.pdf In PDF document text
- http://www.poptopworkshop.com/uploads/1/3/0/6/130639026/bemelufekujiwu_lepazat.pdfIn PDF document text
- http://tolhouse-design.com/uploads/1/3/0/2/130272081/1088283.pdfIn PDF document text
- http://royalglossbrat.com/uploads/1/3/0/7/130740264/zanosonilov_lifinasidinalew.pdfIn PDF document text
- http://airfilledlife.com/uploads/1/3/0/4/130478009/zodejo.pdfIn PDF document text
- http://twincreeksproperties.com/uploads/1/3/0/3/130323818/gasero.pdfIn PDF document text
- http://www.vansrv6a.com/uploads/1/3/0/7/130775680/4bdbcd0522.pdfIn PDF document text
- http://writing4content.com/uploads/1/3/0/5/130539697/c844ccf53272666.pdfIn PDF document text
- http://salaamboston.com/uploads/1/3/0/7/130740073/2233011.pdfIn PDF document text
- http://deletecoinbase.com/uploads/1/3/0/4/130483216/4885894.pdfIn PDF document text
- http://mobilhomebluesky.com/uploads/1/3/0/7/130775350/vabakifajibinido.pdfIn PDF document text
- http://www.pepperpotdaycentre.co.uk/uploads/1/3/0/4/130435835/kalifawatot-nupuka.pdfIn PDF document text
- http://canyonsohana.com/uploads/1/3/0/6/130621557/kenilurodimafofobed.pdfIn PDF document text
- http://treetalkconsulting.com/uploads/1/3/0/9/130969011/3882160.pdfIn PDF document text
- http://litem.net/uploads/1/3/0/7/130740508/9511051.pdfIn PDF document text
- http://mountaingatewaytraining.org/uploads/1/3/0/7/130738988/fosujudogibavovud.pdfIn PDF document text
- http://sigmanuatkwc.com/uploads/1/3/0/5/130546392/lepelutedes.pdfIn PDF document text
- http://45northfarm.com/uploads/1/3/0/7/130739377/gadafaluwose_tigafuba.pdfIn PDF document text
- http://csjunioracademy.com/uploads/1/3/0/4/130483428/30a2cce97.pdfIn PDF document text
- http://meganlarsson.com/uploads/1/3/0/2/130287407/6700811.pdfIn PDF document text
- http://www.pittsburghareatutor.com/uploads/1/3/0/7/130739549/modadowidujo.pdfIn PDF document text
- http://vacationsofdiscovery.voyagerwebsites.com/uploads/1/3/0/3/130323559/130323559.html#balsa+wood+model+airplane+buildingIn PDF document text
🗂 Part of campaign:
miguelchanonafotografo.com
6 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000040de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x40DE | 8400 bytes |
SHA-256: 1a50095762c8e8377b184c9fedf97c07f52ef16563c55693192fdeb63881240f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.